Standalone software and medical device regulation

Future Health Summit

27th May 2016

Cathal BrennanMedical Device Assessor

To protect and enhance public and animal health through the regulation of medicine, medical devices and healthcare products

Our Role

02/05/2023 4

General medical devices

02/05/2023 5

Active Implantable Medical Devices

02/05/2023 6

In-vitro diagnostic devices

02/05/2023 7

02/05/2023 8

Stand alone software‘Stand alone software’ means software which is not incorporated in a medical device at the time of its placing on the market or its making available.

Directive 2007/47/EC amended the definition of the term "medical device" used in Directives 90/385/EEC and 93/42/EEC.

Recital 6 of Directive 2007/47/EC states that "it is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, is a medical device. Stand alone software for general purposes when used in a healthcare setting is not a medical device.“

Stand alone software shall be qualified as an in vitro diagnostic (IVD) medical device or as an accessory to an IVD provided that it satisfies the definition of an IVD or of an accessory to an IVD as set out in Directive 98/79/EC4.

Slide 9

Classification of Medical Devices

Qualification MEDDEV 2.1/6

• Is it a computer programme?

• Incorporated into a MD?• Does it perform an action of

data?• For the benefit of individual

patients?• For purposes defined in

1.2a of MDD?

Slide 10

02/05/2023 11

If standalone SW qualifies as an MD….• Determine which legislation applies • Ensure compliance before placing on market• If in doubt, seek advice on regulatory

requirements

Proportionate regulation

12

Classification

Risk Example

III Complex joint implant, drug eluting stents (DES), coronary valve

IIb Peripheral Bare Metal Stents (BMS),

IIa Contact lenses (short-term), ECG machines, electronic BP monitors

I Wheelchairs, simple wound dressings, Stethoscopes, ECG electrodes, syringes

• pre-market requirements

• conformity assessment route

• clinical data requirements

• post-market obligations

The Essential Requirements aim to ensure medical devices are designed, manufactured and used such that unnecessary risks to patients and users are avoided.

13 Essential Requirements made up of 79 parts covering:

Essential Requirements

Slide 13

PerformanceManufacture

Labelling Usability

Design

Essential Requirements 1 “devices must be designed and manufactured in such a way that….they will not compromise the clinical condition or the safety of patients, orthe safety and health of users or, where applicable, other persons, provided that any risks which may be associated with their intended use constitute acceptable risks when weighed against the benefits to the patient and are compatible with a high level of protection of health and safety”

ER2 states that “solutions adopted by the manufacturer for the design and construction of the devices must conform to safety principles, taking account of the generally acknowledged state of the art. In selecting the most appropriate solutions, the manufacturer must apply the following principles in the following order:

— eliminate or reduce risks as far as possible (inherently safe design and construction),— where appropriate take adequate protection measures including alarms if necessary, in relation to risks that cannot be eliminated,— inform users of the residual risks due to any shortcomings of the protection measures adopted.

Essential Requirements

Slide 14

Essential Requirements 9.1 “if the device is intended for use in combination with other devices or equipment, the whole combination, including the connection system must be safe and must not impair of the devices. Any restrictions on use must be indicated on the label or in the instructions for use”

Essential Requirement 12.1a “devices which incorporate software or which are medical software in themselves, the software must be validated according to the state of the art taking into account the principles of development lifecycle, risk management, validation and verification.”

Essential Requirements

Slide 15

European harmonised standards:

• Provide corresponding technical specifications for meeting the Essential Requirements

• Non-mandatory • Alternate methods for meeting the requirements of the directives are

possible, but obligation to demonstrate conformance• Relevant standards for standalone software:

• IEC 62304 Medical devices software – software lifecycle processes

• EN ISO 14971 Risk Management• ISO 13485 Medical devices - Quality management systems

Harmonised Standards

Slide 16

CE Marking – Conformity Assessment

Class I medical devices are self-declared by the manufacturer with the exception of Class I medical devices which are sterile and/or have a measuring function; a notified body is required to asses the sterility or measuring aspect only of these devices.

CLASS INon-sterile/

Non-Measuring

CLASS ISterile/

MeasuringCLASS

IIaCLASS

IIbCLASS

III

Quality Management System (QMS)

Technical File Design Dossier

QMS and Technical File/Design Dossier audited by Notified BodyCE Certificate awarded

Registration with Competent Authority

(CA)

In general, registration is not required.

CA may request information when placed on market

Draw up Declaration of Conformity (DOC)

1234 1234 12341234

Slide 17

CE Marking – Conformity Assessment

Third party conformity assessment is carried out by notified bodies

Approximately 60 in Europe; e.g. NSAI, BSI, TUV

Conformity Assessment routes laid out in Article 11: Class IIa, IIb and III

CLASS INon-sterile/

Non-Measuring

CLASS ISterile/

MeasuringCLASS

IIaCLASS

IIbCLASS

III

Quality Management System (QMS)

Technical File Design Dossier

QMS and Technical File/Design Dossier audited by Notified BodyCE Certificate awarded

Registration with Competent Authority

(CA)

In general, registration is not required.

CA may request information when placed on market

Draw up Declaration of Conformity (DOC)

1234 1234 12341234

Slide 18

Registration

19

CLASS INon-sterile/

Non-Measuring

CLASS ISterile/

Measuring

System and

Procedure Packs

Custom-made

devices

Quality Management System (QMS)

Technical File Design Dossier

QMS and Technical File/Design Dossier audited by Notified Body

CE Certificate awarded

Registration with Competent Authority

(CA)

In general, registration is not required.

CA may request information when placed on market

Draw up Declaration of Conformity (DOC)

1234 1234 12341234

All Classes of IVDs

Manufacturers, or their authorised representatives, who have a registered place of business in Ireland must register with the HPRA if they place certain classes of medical devices on the Irish/European market:

• Class 1• System & procedure packs• Custom made• IVD’s

Pro-active audits of these registered organisations are routinely carried out by the HPRA to ensure they meet the requirements of the medical device directives.

Post market surveillance

• The manufacturer shall institute and keep up to date a systematic procedure to review experience gained from devices in the post-production phase, including the provisions referred to in Annex X, and to implement appropriate means to apply any necessary corrective actions, taking account of the nature and risks in relation to the product.

• To notify the competent authorities of:Any malfunction, failure or deterioration in the characteristics and/or performance of a device, as well as any inadequacy in the labelling or the instructions for use which, directly or indirectly, might lead to, or might have led to, the death of a patient or user or other persons or to a serious deterioration in his or her state of health

• Standalone software by its nature often leads to INDIRECT Harm

02/05/2023 20

02/05/2023 21

The role of the HPRA

02/05/2023 22

Changes to legislation

• Why?

2302/05/2023

Standalone software & the HPRA

Qualification Clinical investigations

Guidance

Classification Registration

02/05/2023 24

Advice for manufacturers

• Consider Regulations at an early stage• Ensure compliance with legislation:

– Assess whether your standalone software qualifies as medical device

– Ensure it is classified correctly – Follow appropriate conformity assessment– Comply with Essential Requirements– Technical documentation– Register with the HPRA, if required– Post market surveillance and vigilance system …………

• Get advise – experience with medical device SW

02/05/2023 25

Advice for users

• Consider the different standalone software you use– Is it a medical device?– If so, is it CE marked?

• Report any incidents to the manufacturer and the HPRA

• Report any non-complying product to the HPRA

Thank you

Cathal BrennanMedical Device AssessorHuman Products Authorisation and Registration DepartmentTel: +353 1 676 4971Fax: +353 1 676 7836devices@hpra.iewww.hpra.ie 

27